-
Notifications
You must be signed in to change notification settings - Fork 71
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
feat(aws): add support for AWS IAM Roles Anywhere authentication [EE-…
…4614] (#423) * feat(aws): add support for AWS IAM Roles Anywhere authentication * feat(aws): update aws config detection * feat(aws): add logging * feat(aws): also run aws logic for non async stacks * feat(aws): update logging * feat(aws): skip lookup handler if aws config found * feat(aws): do not start registry server if aws config is found * feat(aws): remove docker config if aws config is found * feat(aws): update credentials logic to hook into portainer helper * chore(aws): code cleanup * chore(aws): code cleanup * feat(aws): update temp credentials logic * feat(aws): update imports and dependencies * feat(aws): add missing error handler * feat(aws): update comment * feat(agent): base agent version on 2.16.0 * chore(agent): bump agent version to 2.17.0
- Loading branch information
1 parent
8ae5b6a
commit d07dcb4
Showing
7 changed files
with
235 additions
and
31 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,73 @@ | ||
| package registry | ||
|
|
||
| import ( | ||
| "context" | ||
|
|
||
| "github.com/aws/aws-sdk-go-v2/config" | ||
| "github.com/aws/aws-sdk-go-v2/credentials" | ||
| iamra "github.com/aws/rolesanywhere-credential-helper/aws_signing_helper" | ||
| "github.com/awslabs/amazon-ecr-credential-helper/ecr-login/api" | ||
| "github.com/portainer/agent" | ||
| "github.com/rs/zerolog/log" | ||
| ) | ||
|
|
||
| func doAWSIAMRolesAnywhereAuthAndGetECRCredentials(serverURL string, awsConfig *agent.AWSConfig) (*agent.RegistryCredentials, error) { | ||
| iamraCreds, err := authenticateAgainstIAMRA(awsConfig) | ||
| if err != nil { | ||
| return nil, err | ||
| } | ||
|
|
||
| factory := api.DefaultClientFactory{} | ||
|
|
||
| cfg, err := config.LoadDefaultConfig( | ||
| context.TODO(), | ||
| config.WithRegion(awsConfig.Region), | ||
| config.WithCredentialsProvider(credentials.NewStaticCredentialsProvider(iamraCreds.AccessKeyId, iamraCreds.SecretAccessKey, iamraCreds.SessionToken)), | ||
| ) | ||
| if err != nil { | ||
| log.Err(err).Msg("unable to build AWS client config") | ||
| return nil, err | ||
| } | ||
|
|
||
| client := factory.NewClient(cfg) | ||
|
|
||
| creds, err := client.GetCredentials(serverURL) | ||
| if err != nil { | ||
| // This might not be an ECR registry | ||
| // Therefore we deliberately not return an error here so that the upstream logic can fallback to other credential providers | ||
| log.Warn().Str("server_url", serverURL).Err(err).Msg("unable to retrieve credentials from server") | ||
| return nil, nil | ||
| } | ||
|
|
||
| return &agent.RegistryCredentials{ | ||
| ServerURL: serverURL, | ||
| Username: creds.Username, | ||
| Secret: creds.Password, | ||
| }, nil | ||
| } | ||
|
|
||
| func authenticateAgainstIAMRA(awsConfig *agent.AWSConfig) (*iamra.CredentialProcessOutput, error) { | ||
| credentialsOptions := iamra.CredentialsOpts{ | ||
| PrivateKeyId: awsConfig.ClientKeyPath, | ||
| CertificateId: awsConfig.ClientCertPath, | ||
| RoleArn: awsConfig.RoleARN, | ||
| ProfileArnStr: awsConfig.ProfileARN, | ||
| TrustAnchorArnStr: awsConfig.TrustAnchorARN, | ||
| SessionDuration: 3600, | ||
| NoVerifySSL: false, | ||
| WithProxy: false, | ||
| Debug: false, | ||
| } | ||
|
|
||
| if awsConfig.ClientBundlePath != "" { | ||
| credentialsOptions.CertificateBundleId = awsConfig.ClientBundlePath | ||
| } | ||
|
|
||
| credentialProcessOutput, err := iamra.GenerateCredentials(&credentialsOptions) | ||
| if err != nil { | ||
| log.Err(err).Msg("unable to authenticate against AWS IAM Roles Anywhere") | ||
| return nil, err | ||
| } | ||
|
|
||
| return &credentialProcessOutput, nil | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.